Data is Transparency, and Transparency Builds Trust

It starts with a credential

A workload asks its agent for an identity, and the Defakto server running in your environment issues an SVID. The server also records an svid_issued event that says which workload got the credential, when, and from which deployment.

The server puts the event in a buffer in memory. Issuing a credential never waits on the network, so recording the event doesn’t slow your workloads down. They have places to be.

Sent to the control plane

Every few seconds, the server sends its buffered events to the Defakto control plane in one batch over mutual TLS (mTLS). The control plane collects events from every Defakto server in your organization, across all of your trust domain deployments.

How does the control plane know whose events they are? The event itself doesn’t say. The control plane reads the organization and deployment from the server’s SPIFFE ID on the mTLS connection, so a server can only write events into its own organization.

Made durable before anyone says “got it”

Before it replies to the server, the control plane writes each event to an encrypted, durable buffer in Kinesis. The server keeps its own copy until that reply arrives, and if anything fails along the way, the server sends the event again.

Everything after this point reads from that buffer.

One event, three uses

Three independent readers pick the event up from the buffer, and each one answers a different question about your system. None of them waits on the others, so a slow forwarding destination doesn’t delay what you see in the console.

What happened?

The archive writes every event to S3. We keep important events, like audit logs, for seven years, which is longer than most of the workloads they describe will be around. We also copy security events to a separate, locked backup where nobody can change or delete them.

The archive is the source of truth. If we ever need to rebuild another view of your data, we rebuild it from here.

What’s happening right now?

The search pipeline turns the event into documents in OpenSearch, which keeps each organization’s data separate. The event is searchable within seconds of the credential being issued, and it shows up in the issuance chart for its trust domain.

On your screen

Open a trust domain’s audit log in the Defakto console, and the event is at the top, next to other credentials, agent attestations, federation checks and API requests. The credential counts and charts on each page come from the same search index.

The control plane filters every query to your organization and to what your account can see, so the same data can serve everyone on your team.

Can you keep your own copy?

We’d like you to trust us, but we’d also like you to verify. Forwarding sends your credential issuance events, as they happen, to a destination you choose, such as a security vendor that ingests identity signals, your SIEM, or a service you run that stores them in your own S3 bucket or OpenSearch cluster.

Each event is a Security Event Token, the standard format from the OpenID Shared Signals Framework. Defakto signs every delivery with a key unique to your organization, and your destination checks the signature against our public keys, so there’s no shared secret to store or rotate.

Each subscription has its own queue, so one slow destination doesn’t hold up another.

Set up event forwarding in the Defakto docs.